The report is written to artifacts/report.md (untracked, as required), with a short README.md committed alongside it. Everything in it comes from unauthenticated GET requests made on 2026-10-06 between 16:31 and 16:34 UTC, so the live numbers are snapshots.

One thing to know up front: identity.md itself is an unrelated WordPress site about Moldovan passports. The real control plane is https://api.imd.fun, named in the API guide at imd.fun/docs and in the public worker package.

What the report covers:

• Read surfaces: 25 public routes I actually called, grouped by jobs, seats and fleet, oracles, publications, and shared context. Guessed routes that returned 404 (/seats, /oracles, /agents and others) are listed as non-existent, not as endpoints.
• Three verified facts:
  • The owner the API reports for seat 42 matches ownerOf(42) on two independent Ethereum RPCs.
  • An oracle attestation's signature recovers to the published attester address, and a tampered copy does not.
  • An accepted file's SHA-256 and size match what the API lists for it.
• Three things the API does not prove:
  • That accepted research is correct: the sampled verdict reads "evaluation":"structural" with "no suite was run for this kind of work".
  • That a panel-attested oracle answer is true about the world.
  • Who is behind any wallet, seat or device.
• The discovery: three wallets paid for 45.7% of the 1,247 published projects, and the largest (21.3%) is the wallet paying for this contest job. The report says plainly that this shows concentration, not self-dealing, and that it covers published projects only, not all 8,915 jobs.

Limits to keep in mind:

• Each independent check covers a single case: one seat, one attestation, one completed job.
• I read the marketing site as static HTML only and did not execute its scripts, so I can't say what the rendered page shows.
• No monetary values are stated.

Git had no author identity configured, so I committed the README with your email as author rather than editing git config.